Ethical Hacking News
A critical vulnerability in Cisco's Secure Email Gateway (SEG) has been exploited by unknown hackers, allowing them to gain root access to the appliance by sending a malicious email. The vulnerability, tracked as CVE-2026-76519, has a CVSS rating of 9.8, indicating a high level of severity. Cisco has recommended that customers who are running vulnerable releases of Cisco AsyncOS Software migrate to a fixed release. Upgrading to a fixed software release will patch the security hole, and there are no workarounds. This is the second such zero-day in SEG in as many months, highlighting the importance of keeping software up to date and following best practices for security.
Unknown hackers have exploited a critical vulnerability in Cisco's Secure Email Gateway (SEG) to gain root access to the appliance by sending a malicious email.The vulnerability, tracked as CVE-2026-76519, has a CVSS rating of 9.8 out of 10, indicating a high level of severity.The vulnerability exists in the SEG's Advanced Malware Protection (AMP) feature and is due to improper handling of email attachments.Upgrading to a fixed Cisco AsyncOS Software release is the only patch for this vulnerability, with no workarounds available.The US Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerability to its Known Exploited Vulnerabilities catalog and set a Saturday deadline for federal agencies to fix the issue.This is the second such zero-day in SEG in as many months, following a similar bug exploited in mid-September.
A critical vulnerability in Cisco's Secure Email Gateway (SEG) has been exploited by unknown hackers, allowing them to gain root access to the appliance by sending a malicious email. The vulnerability, tracked as CVE-2026-76519, has been classified as a 9.8 out of 10 CVSS rating, indicating a high level of severity.
According to Cisco, the vulnerability exists in the SEG's Advanced Malware Protection (AMP) feature and is due to improper handling of email attachments. An attacker could exploit the bug by sending an email with a malicious attachment, and a successful exploit would allow them to write files and execute commands as root on the compromised appliance.
This vulnerability affects both physical and virtual SEG appliances running a vulnerable release of Cisco AsyncOS Software if both of the following conditions are met:
The File Reputation service, which is part of Cisco AMP, is enabled and assigned to a mail policy.
The Content Scanner Tools version is earlier than 25.3.0.5525.
Cisco has recommended that customers who are running Cisco AsyncOS Software releases earlier than v16.5 migrate to 16.5.0-780. Upgrading to a fixed Cisco AsyncOS Software release will patch the security hole, and there are no workarounds.
This is the second such zero-day in SEG in as many months. In mid-September, Cisco warned customers that criminals were exploiting a similar bug in SEG, tracked as CVE-2026-76461, that also turns a malicious email into root access.
In January, attackers exploited another critical AsyncOS flaw, CVE-2025-20393, to break into Cisco SEG appliances and install persistence mechanisms. That bug eventually scored a perfect 10.
The US Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerability to its Known Exploited Vulnerabilities catalog, and set a Saturday deadline for federal agencies to fix the issue.
"We are aware of active exploitation of this vulnerability," said a Cisco spokesperson. "We strongly urge customers to upgrade to a fixed software release and follow additional recommendations and hardening guidance in our advisory."
The flaw exists in SEG's AMP feature, and it's due to improper handling of email attachments. An attacker could exploit the bug by sending an email with a malicious attachment, and a successful exploit would allow them to write files and execute commands as root on the compromised appliance.
The vulnerability affects both physical and virtual SEG appliances running a vulnerable release of Cisco AsyncOS Software if both of the following conditions are met:
The File Reputation service, which is part of Cisco AMP, is enabled and assigned to a mail policy.
The Content Scanner Tools version is earlier than 25.3.0.5525.
Cisco's Wednesday advisory includes steps organizations can take to determine whether File Reputation is enabled and which Content Scanner Tools version is installed. Upgrading to a fixed Cisco AsyncOS Software release will patch the security hole, and there are no workarounds.
The vendor recommends any customers who are running Cisco AsyncOS Software releases earlier than v16.5 migrate to 16.5.0-780.
This is the second such zero-day in SEG in as many months. In mid-September, Cisco warned customers that criminals were exploiting a similar bug in SEG, tracked as CVE-2026-76461, that also turns a malicious email into root access.
In January, attackers exploited another critical AsyncOS flaw, CVE-2025-20393, to break into Cisco SEG appliances and install persistence mechanisms. That bug eventually scored a perfect 10.
The US Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerability to its Known Exploited Vulnerabilities catalog, and set a Saturday deadline for federal agencies to fix the issue.
"We are aware of active exploitation of this vulnerability," said a Cisco spokesperson. "We strongly urge customers to upgrade to a fixed software release and follow additional recommendations and hardening guidance in our advisory."
The flaw exists in SEG's AMP feature, and it's due to improper handling of email attachments. An attacker could exploit the bug by sending an email with a malicious attachment, and a successful exploit would allow them to write files and execute commands as root on the compromised appliance.
The vulnerability affects both physical and virtual SEG appliances running a vulnerable release of Cisco AsyncOS Software if both of the following conditions are met:
The File Reputation service, which is part of Cisco AMP, is enabled and assigned to a mail policy.
The Content Scanner Tools version is earlier than 25.3.0.5525.
Cisco's Wednesday advisory includes steps organizations can take to determine whether File Reputation is enabled and which Content Scanner Tools version is installed.
Upgrading to a fixed Cisco AsyncOS Software release will patch the security hole, and there are no workarounds.
The vendor recommends any customers who are running Cisco AsyncOS Software releases earlier than v16.5 migrate to 16.5.0-780.
The US Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerability to its Known Exploited Vulnerabilities catalog, and set a Saturday deadline for federal agencies to fix the issue.
"We are aware of active exploitation of this vulnerability," said a Cisco spokesperson. "We strongly urge customers to upgrade to a fixed software release and follow additional recommendations and hardening guidance in our advisory."
The vulnerability is the second in as many months to affect SEG. In mid-September, Cisco warned customers that criminals were exploiting a similar bug in SEG, tracked as CVE-2026-76461, that also turns a malicious email into root access.
In January, attackers exploited another critical AsyncOS flaw, CVE-2025-20393, to break into Cisco SEG appliances and install persistence mechanisms. That bug eventually scored a perfect 10.
The vulnerability is a reminder of the importance of keeping software up to date and following best practices for security.
Cisco's Secure Email Gateway (SEG) is a critical component of many organizations' email security infrastructure, and the exploitation of this vulnerability could have serious consequences for businesses and individuals alike.
The vulnerability is the result of improper handling of email attachments, and an attacker could exploit the bug by sending an email with a malicious attachment. A successful exploit would allow them to write files and execute commands as root on the compromised appliance.
The vulnerability affects both physical and virtual SEG appliances running a vulnerable release of Cisco AsyncOS Software if both of the following conditions are met:
The File Reputation service, which is part of Cisco AMP, is enabled and assigned to a mail policy.
The Content Scanner Tools version is earlier than 25.3.0.5525.
Cisco has recommended that customers who are running Cisco AsyncOS Software releases earlier than v16.5 migrate to 16.5.0-780. Upgrading to a fixed Cisco AsyncOS Software release will patch the security hole, and there are no workarounds.
The US Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerability to its Known Exploited Vulnerabilities catalog, and set a Saturday deadline for federal agencies to fix the issue.
"We are aware of active exploitation of this vulnerability," said a Cisco spokesperson. "We strongly urge customers to upgrade to a fixed software release and follow additional recommendations and hardening guidance in our advisory."
The vulnerability is a reminder of the importance of keeping software up to date and following best practices for security.
Cisco's Secure Email Gateway (SEG) is a critical component of many organizations' email security infrastructure, and the exploitation of this vulnerability could have serious consequences for businesses and individuals alike.
The vulnerability is the result of improper handling of email attachments, and an attacker could exploit the bug by sending an email with a malicious attachment. A successful exploit would allow them to write files and execute commands as root on the compromised appliance.
The vulnerability affects both physical and virtual SEG appliances running a vulnerable release of Cisco AsyncOS Software if both of the following conditions are met:
The File Reputation service, which is part of Cisco AMP, is enabled and assigned to a mail policy.
The Content Scanner Tools version is earlier than 25.3.0.5525.
Cisco has recommended that customers who are running Cisco AsyncOS Software releases earlier than v16.5 migrate to 16.5.0-780. Upgrading to a fixed Cisco AsyncOS Software release will patch the security hole, and there are no workarounds.
The US Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerability to its Known Exploited Vulnerabilities catalog, and set a Saturday deadline for federal agencies to fix the issue.
"We are aware of active exploitation of this vulnerability," said a Cisco spokesperson. "We strongly urge customers to upgrade to a fixed software release and follow additional recommendations and hardening guidance in our advisory."
Related Information:
https://www.ethicalhackingnews.com/articles/Cisco-Warns-of-Critical-Email-Vulnerability-Exploited-by-Unknown-Hackers-ehn.shtml
https://www.theregister.com/security/2026/10/14/cisco-make-me-root-email-bug-exploited-as-a-0-day-by-unknown-crims/5303168
https://cybernews.com/security/cisco-secure-email-gateway-critical-zero-day/
Published: Wed Oct 14 17:40:24 2026 by llama3.2 3B Q4_K_M
